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METHOD AND ARRANGEMENT FOR PERFORMANCE ANALYSIS OF DATA 
NETWORKS 



TECHNICAL FIELD 

5 The present invention relates to performance analysis of 
data networks . 

TECHNICAL BACKGROUND 

INTRODUCTION 

In order to follow up on network performance, a network 
10 manager needs to monitor the network's vital parameters. He 
needs to know if any part of the network is congested at 
any time, or if the traffic growth in a part of the network 
will necessitate action in the immediate future' to increase 
the capacity, restructure the network or modify the routing 
15 in order to avoid future perturbances in the network 

operation. If parts of the network are over-provisioned, he 
might want to reduce the capacity of certain links in order 
to reduce network operating costs. 

Performance data can be used to detect problems that arise 
20 during network operation, or to detect trends in the 

network so that corrective action, can be taken before a 
problem develops. 

The data collected from the network can be exploited either 
manually by an operator, or automatically by report 
. 25 generators, correlation tools and even systexs :hat can 
automatically respond to anomalies in the network by 
actively doing a reconfiguration to solve a detected 
problem. 
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THE PROBLEM AREA 

Network elements maintain counters that can be used to get 
a picture of traffic, error rates etc. at that specific 
point in the network. The values' of such counters can be 
retrieved in a variety of manners, depending on the 
capabilities of the network element, and the kind of 
management functions (protocols) that it supports. 

The most common datacom management protocol is. SNMP (Simple 
Network Management Protocol). This protocol supports, 
retrieval of specific data objects from a network' element 
in a query/reply fashion. Other alternative protocols are 
FTP or Telnet. 

It is often desirable to apply mathematical functions to 
data objects retrieved from network elements, or somehow 
compare the values of these data objects. This. makes sense 
only if the values that participate in the calculation (or 
the comparison) are sampled at the same time. 

As' an example of such a calculation, let's for example 
assume that we retrieve the objects ifOutOctets (number of 
octets sent on the interface), iflnOctets. (number of octets 
received on the interface) and .ifSpeed (interface 
transmission rate in bits per second) from. a network 
element, for a specific half-duplex interface, and we wish- 
to calculate Bandwidth .Utilisation (BU) as the ratio ' 
between traffic (ifOutOctets + iflnOctets), and the 
available bandwith (ifSpeed) . 

BU = (ifOutOctets. + if InOctets ) *8 /if Speed 

Especially since a lot of the data retrieval is done using 
the query/reply paradigm, we cannot assume that samples for 
several data objects can be retrieved from network elements 
simultaneously. If the values used for ifOutOctets and 
iflnOctets in the above expression are not sampled 
simultaneously, the result might turn out to be 
significantly wrong. 
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There are several reasons why we cannot assume that , 
multiple objects can be retrieved simultaneously. First of 
all this would result in clusters of data retrievals around 
specific times. The computer system may not have the 
5 " capacity to process that amount of data with an acceptable 
delay, and these bursts of network traffic may result in 
traffic delays and even network congestion. In the other 
end, the network element .needs to respond, virtually 
instantaneously to all the queries, which requires a 
10 sufficient amount of processing power which should be used 
to the network elements primary task, i.e. forwarding data. 

What we really might want is to define measurements 
starting at a specific time, with a specific sampling 
frequency. However, by doing so we will get sampling 
15 clusters since a large number of the measurements will 

inevitably be defined to start at the same minute past the 
hour, with the same sampling frequency. It would therefore, 
be better to randomise the start of the measurements within 
some reasonable interval. 

20 Due to the inability to read and reset a timer 

simultaneously (except when this function is supported by 
the timer hardware), and that multiple timers are emulated 
in software, the actual measurement intervals will skew 
some fractions of a second in time for each period. 

25 Another problem that has to be addressed is that one might 
want to compare to data objects sampled at different 
intervals. 
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KNOWN SOLUTIONS 

HP OpenView Network Node Manager is a network management 
tool, providing in-depth views of the network in a 
graphical format. The tool discovers network devices and 
provides a map of the network. The map indicates which 
devices and network segments are healthy and which areas 
need attention, e.g. if a device fails the Network Node 
Manager evaluates the event stream and pinpoints the cause 
of the failure. The Network Node Manager also includes an 
SNMP data collector that can be configured to retrieve data 
from network elements at specified time intervals, and 
provides graphing utilities for browsing, both old data as 
well as incoming data in real time. 

However, to our knowledge, HP Openview snmpcollect /xnmgraph 
does not perform time normalisation as described in this 
document . 

THE INVENTION . 
BRIEF DESCRIPTION OF THE INVENTION 

The fundamental idea presented in this document is to use 
linear interpolation to calculate measurement values for an 
arbitrary time, independently of the time the measurement 
was started, and the sampling frequency. This process is 
what we will refer to as time normalisation. 

t a s£t of computation stages and techniques to 
performance analysis tool with performance data 
from the network, that are suitable for ulterior 
or data computationally derived from data 
from the network. 

The exact scope of the invention is as defined in the 
appended patent claims . 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The invention' will now be further described with reference 
to the accompanying drawings, in which: 

Figure 1 illustrates the data collection and analysis 
process as used in the present invention 

of the Performance Local Agent 
system. 

Figure 3 is a graph showing counter wrap-around and the 
corresponding measurement values calculated as the 
difference between measurement samples. 

Figure 4 shows multiple wrap-arounds during a sampling 
interval, which will get undetected. 

Figure 5 shows another example of undetected wrap-around. 
Figure 6 shows" normalisation of sampling interval. 

Figure 7 is a time 
sampling times and 

Figure 8- illustrates the process according to the present 
invention. 

AMPLIFIED DESCRIPTION 

Figure 1 illustrates the data collection and analysis 
process. Data is collected from the network elements using 
the appropriate method,, depending on the network element 
capabilities or- the preferred collection method. Collected 
samples are stored in the Performance Database (PDB) for 
ulterior retrieval. Among performance system clients we 
will find tools ranging from simple graphing tools to 
sophisticated analysis software capable of generating a 
bill of health for the network or even take corrective 
action with no operator interaction. 



Figure 2 shows . the layering 
used in the data collection 



series showing the relationship between 
normalised sampling ■ times . 
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DERIVED OBJECTS 

Derived objects are objects which values are defined as a 
mathematical function of real objects collected from the 
network elements. 

5 Derived objects. will be defined in the network element type 
configuration file as all other objects. The information 
that needs to be included in a derived object definition is 

° the name of the derived object 

© a description of the derived object 

10 o a unit, e.g. 

o a mathematical expression 

From an external point of view, a derived object should 
appear to be just like a real object, i.e. an object 
available on a network element. 

15 In order to simplify parsing and interpretation of the 
expressions describing the derived objects, we suggest 
using arithmetic postfix notation. Using an example 
expression with objects taken from the MIB-2 interface 
group 



20 



ifOutOctets * 8 

— 3 r * 100 

ifSpeed 



the postfix-expression will be 

ifOutOctets 8 * ifSpeed / 100 * 
ifOutOctets. 8 100 ifSpeed / * * 
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The advantage of using postfix notation is that the 
associativity is implicit, and the grammar is parsable by 
an LL(1) parser. The algorithm would consist in pushing all 
symbols on the stack until an operator is encountered, upon 
which 2 operands are popped from the stack, the result is 
computed and pushed back onto the stack. The algorithm is 
repeated until the parser either runs out of expression 
string, or the stack is empty. If both occur at the same 
time, the expression is correct. 

The inconvenience is that the expressions are not 
intuitively obvious to the untrained eye.* 

PERFORMANCE LOCAL AGENT (PLA) 

PLA is the external interface of the data collection 
system. The task of PLA is to store new jobs in the 
Performance Database (PDB) and retrieve data on request 
from a client. Database access is done through the PDB 
Interface (PDBI) . 

In addition to just retrieve the data from PDB and deliver 
it to the requesting client, PLA will also be capable of 
doing additional processing of the data. PLA will hence be 
able to compute the values of derived objects, calculate 
the values of objects at exact time intervals by 
interpolating sample data in PDB, and by this provide 
clients with an abstract view of the data. 

For comparison purposes it is necessary for a client to be 
able to retrieve values for a pair of data objects sampled 
at the exact same times. Also for the sake of computation 
of derived objects, it is necessary to obtain values for 
the objects participating in the derived object expression 
that are sampled 'at the exact same times. 



WO 01/41361 PCT/NOOO/00403 

8 

Since we do not believe that it is possible to. obtain 
samples for measurement objects at the exact same time, we 
will have 'to perform some computations on the sample data 
to calculate intermediary values for the exact times we 
need samples. 

Another relevant issue is that a large number of the 
objects that we are interested in collecting are counters. 
We define a counter as a register which value increases 
monotonically until the register overflows in which case it 
is reset to zero plus the overflow, as opposed to a gauge 
which gives an instantaneous value for some parameter, e.g. 
CPU load. For some data, the performance data collector 
might use an external data collector to do the data 
collection per se, and only parse the collected data, which 
are subsequently stored in PDB. In this case the external 
data collector takes care of handling the wrapping of the 
register, and the value reported is the delta between two 
subsequent samples. 

Performance manager must treat data not . collected by an 
external collector providing the above-described 
functionality, i.e. delta calculation must be performed at 
some point. 

The calculation could be done in real-time, i.e. at the 
time the data is actually received from the network 
element, and the calculated data stored in the database 
together with real-object values, but that might possibly 
have a severe impact on the capacity of the system 'to 
perform data collection, and will increase the database 
transaction rate. Calculation of the value of derived 
object also depends on several real-object values that have 
to be time-normalised prior to calculation of, the derived 
object value. 
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In any case, the performance manager will need to know how 
to treat the data according to whether they are counter- 
data or gauges - 

Presentation Layer 

The task of the PLA Presentation Layer is to deliver 
measurement values to the above layer, which are normalised 
. with respect to time. 

A measurement sample is the content of a register retrieved 
from a network element, with no further processing by the 
performance management system, as opposed to a measurement 
value which is the result of the application of a function 
on the corresponding measurement samples. 

The time normalisation process consists in calculating 
measurement values for a performance parameter, at specific 
times, usually defined by an initial time and a delta 
increment . ■ . 

Notation 

We will denote sampling times, i.e. the times at which 
samples were collected, as t ± for i.>.0, and normalised 
times as Ti=T 0 +i*DT for i > 0. 

For value of a measurement sample, at time. t we will use the 
notation s(t), and v(t) for the corresponding measurement 
value. 

Calculating measurement values 

In Figure 3 the first graph shows the evolution of a 
counter which includes a wrap-around between times t x and 
t 2 - The second graph shows the corresponding measurement 
values determined by calculating the difference between 
measurement samples. 
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In most cases a measurement value can be expressed as v(t A ) 
= s (ti) - s(ti-i) for i > 0. However if a counter wrap- 
around is detected (by the fact that s (ti) < s(ti-i)), the 
calculation will have to be v(t ± ) = s max + s(ti) - s(ti-i), 
where s max is the maximum integer containable by the 
counter. 

In the case of multiple counter wrap-arounds during a 
sampling interval, as illustrated in Figure 4, the 
calculation will yield incorrect values. This is 
unfortunately unavoidable since there is no way to tell how 
many times a counter has wrapped around during a sampling 
interval . 

Another anomaly that may occur is a wrap-around followed by 
a fast growth of the counter, illustrated in figure 10. In 
that case we will not be able to detect any wrap-around at 
all, and the computed value will be significantly smaller 
than reality. 

The only way to alleviate these two problems, is to increase' 
the sampling frequency - within reasonable limits, or 
increase the size of the registers in the network elements. 

Normalisation of measurement interval 

As discussed previously, especially in ccis^ oi derived 
object computation, we need to deliver vu.uc-r- at' exact 
times. In order to achieve this, we will u-surr.e that the 
growth of the counter is linear through no sampling 
interval. 

In Figure 6, v(T 3 ) is the sum of the area:, celirr.ited by the 
averages and the sampling times. 

Let t k , k e [0, -» be the sampling times, -and T fc , k e 
[0,. .— » .the normalised sampling times. Assuming that ti " is 
the first sampling time after Tj-i and t n is the first 
sampling time after Tj as illustrated in Figure 7. 
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as 



The measurement value at time Tj can be expressed 



',m» v(t i) * (t i ~ T i-l) V(t ) * (T- - t- \ 

V(T ^ = \ . ; — + 2 V(t k ) + ^ 5 Hszil 

ti + a k-i + l t n - t^ 



During a sampling interval <t i _ 1 ,t i ], the average 
measurement value is the quotient of v( ti ) and the length 
of the interval. By multiplying this average with time 
elapsed, we obtain the cumulative value between two in- 
termediary times within the interval. 

Calculation Layer 

The role of the Calculation Layer is to retrieve the 
required data from the presentation layer, perform adequate 
calculations on those data if necessary i.e. if the object 
requested was a derived object, and return data for the 
•requested object. 

If the requested object is a derived object, the 
Calculation layer must request normalised measurement 
values. for each real measurement object that appears in the 
derived object formula, apply the formula to the data and 
return the resulting data set. 

Otherwise the Calculation Layer retrieves values for the 
requested measurement object from the Presentation Layer. 
No time normalisation is required since the primary goal of 
time normalisation is to obtain measurement values for 
different objects that are comparable. 
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ADVANTAGES 

o Time-normalisation of collected samples enables 
. comparison and correlation of performance data values 
either manually through analysis of graphical 
presentation of the data, or by a performance analysis 
tool, when data are not collected simultaneously or are 
collected at different time intervals. 

° We provide the possibility of defining derived objects 
and present their values to a client as if they were 
real objects (collected from network elements), 
transparently. 

CONCLUSIONS ' 

We have presented an entire framework for presenting data 
objects collected from network elements, as well as so- 
called derived objects to performance analysis and 
reporting tools. We have specifically solved the problem o 
delivering data sampled at the virtually exact time, where 
the time is determined ' by the time of the first sample, an 
a fixed sampling frequency, so that ulterior processing 
stages are provided with and instantaneous image of the 
network. Although this is an approximation which exactitud 
depends on the sampling frequency,' it is the best we can 
get given the techniques used for collection of samples 
from the network elements. 

The input to the process is one or more streams of samples 
for a time interval; one stream for each data object 
collected from a network element, in chronological order. 
Each stream is then processed by the presentation layer 
which output is the same streams as the input, but where 
the streamed data are rearranged so that each stream has a 
one datapoint for the -specific times, at a specific 
frequency, still in chronological order, as illustrated in 
Figure 8 . 
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The final stage in the process consists of the calculation 
of the derived object, which results in a single data 
stream. 

The result of the process can be used to generate human 
readable reports used for network planning or 
troubleshooting, right-sizing of the network capacity, 
Service Level Agreement (SLA) analysis and monitoring, 
traffic-based routing and even automatic correction of 
error conditions in the network. 
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Patent el 5 " aims 

1. Method for performance analysis of data networks, where 
data is collected as measurement- samples from the 
individual network elements at asynchronous sampling 
intervals, which data is stored in a Performance Database, 
characterised i n that said database is 
maintained by a Performance Local Agent, which stores 
collected data, in the database, retrieves data from the 
database on request from a client, normalises said 
measurement samples v(t) so to appear as measurements v(T) 
sampled at exactly the same sampling times, and-processes 
the data into values that indicate the health of the 
network and provide clients with a view of the resulting 
values . 

2. Method as claimed in claim 1, 

characterized in that said measurement . 
samples are normalised by statistical estimation or linear 
interpolation methods. 

3. Method as claimed in claim 2, 

characterized in that the sampled 
measurements v(t) are normalised according to the formula: 

v(ti) * (t i - T i _ 1 ) n-i v(t ) * (T- - t ) 

fc i ~ t i+1 k=i+1 t n - t n _j 



where tk denotes the actual sampling time, Tk denotes the 
normalised sampling time, k- e [0, for the letters i, j 

and n, reference is made to Figure 7. 

4. Method as claimed in claim 3, 

characterised in that said network elements 
include event counters, e;g. which count the traffic in a 
network element or the error rate, and/or gauges, e.g. 
which measure the instantaneous resource usage. 
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5. Method as claimed in claim 4, 

characterised in that said measurement 
samples are retrieved from each network element using SNMP 
(Simple Network Management Protocol), FTP or Telnet. 

5 6. Arrangement for performance analysis of data networks, 
where data is collected as measurement samples from 
individual network elements at in-synchronous sampling 
intervals, said data is stored in a Performance Database 
characterised in. that the database is ' 
10 maintained by a Performance Local Agent, which includes a 
Performance Database Interface, a Presentation Layer and a 
Calculation Layer,' 

which Performance' Local Agent is adapted to store and 
retrieve said data in said database through the PDB 
15 Interface,- 

for presentation to a client, said data is retrieved as 
streams of measurement . samples for each element, 
said streams of measurement samples are time normalised in 
the Presentation Layer into corresponding synchronous 

2 0 streams of samples, 

the Calculation Layer is adapted to calculate values of 
derived objects from said synchronous streams of samples 
and to output the result as a single' stream of values, 
which objects indicate the operating conditions in the 
25 network and provide the client with a view of the objects. 

7. Arrangement as claimed in claim 6, 

characterized in that said measurement 
samples are normalised by statistical estimation or linear 
interpolation methods. 

3 0 8. Arrangement as claimed in claim 7, 

characterized in that the samples v(t) are 
normalised according to the formula: 

v(t. ) * (t. — Ti 1) n-1 V (t ) * (T- — t ,) 

v(T,) = — ^ — ^ azii + 2 v(tk ) + ZLEsi ih hzll 

t i ~ t i + l k = i + l t n - t n-1 
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where tk denotes the actual sampling time, Tk denotes the 
normalised sampling time, k € [0, -», for the letters i, 
and n, reference is made to Figure 7. 

9. Arrangement as claimed in claim 8, 

characterised in that said network elements 
include event counters, e.g. which count the traffic in a 
network element or the error rate, and/or gauges, e.g. 
which measure the instantaneous resource usage. 

10. Arrangement as claimed in claim 9, 

characterised in that said measurement 

samples are .retrieved from each network element using SNMP 

(Simple Network Management Protocol), FTP or Telnet. 
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- — - Sample average over a sampling interval 
V/tfZ4$i Cumulative value since last normalized sampling time 



Figure 6 



— 1 — 


h- 


— 1 — 1 


h—i — 


1 r 


ti-1 






\\-Z Vl 




Tj-i 




r 


i 



Figure 7 



WO 01/41361 



PCT/NO00/00403 



4/4 




INTERNATIONAL SEARCH REPORT 



A. CLASSIFICATION OF SUBJECT MATTER 

IPC 7 H04L12/00 G06F11/O0 



International Application No 

f ./NO 00/004G3 



According to International Patent Classification (IPC) or to both national classification and IPC 



B. FIELDS SEARCHED 



Minimum documentation searched (classification system followed by classification svmbolsl 

IPC 7 H04L GG6F 



Documentation searched other than minimum documentation to the extent that such documents are included in the fields searched 
Electronic data base consulted during the international search (name of data base and, where practical, search terms used) 

EPO-Internal 



C. DOCUMENTS CONSIDERED TO BE RELEVANT 



Category • Citation of document, with indication, where appropriate, of the relevant passages 



WO 99 45468 A (PEROT SYSTEMS CORP) 

10 September 1999 (1999-09-10) 

page 1, line 10 -page 11, line 22; claims 

1-27 



US 5 561 769 A (KUMAR VI JAY P 
1 October 1996 (1996-10-01) 
abstract; claims 1-15 



ET AL) 



OETIKER T: "MRTG - The Multi Router 
Traffic Grapher" 

PROCEEDINGS OF THE TWELFTH SYSTEMS 
ADMINISTRATION CONFERENCE ( LISA '98 ), 

6-11 December 1998, pages 141-147, 
XP0O2991598 
Boston MA 
the who! e document 



V- 



Relevant to claim No. 



1-10 



1-10 



1-10 



| X I Furt her documents are listed in the continuation of box C. 
a Special categories of cited documents : 



X [ Pa,en t family members are fisted in annex. 



"A" document defining the general state of the art which is not 
considered to be of particular relevance 

"E" earlier document but published on or after the international 
filing date 

"L" document which may throw doubts on priority claim(s) or 
which is cited to establish the publication date of another 
citation or other special reason (as specified) 

"O" document referring to an oral disclosure, use, exhibition or 
other means 

"P" document published prior to the international filing date but 
later than the priority date claimed 



Date of the actual completion of the international search 



7 March 2001 

Name and mailing address of the ISA 

European Patent Office, P.B. 5818 Patenttaan 2 
NL - 2280 HV Rijswijk 
Tel. (+31-70) 340-2040. Tx. 31 651 epo nl, 
Fax: (+31-70) 340-3016 



"T" later- document published after the international filing date 
or priority date and not in conflict with the application but 
cited to understand the principle or theory undertyina the 
invention 9 

*X" document of particular relevance; the claimed invention 
cannot be considered novel or cannot be considered to 
involve an inventive step when the document is taken alone 

"Y" document of particular relevance; the claimed invention 

cannot be considered to involve an inventive step when the 
document is combined with one or more other such docu- 
ments, such combination being obvious to a person skilled 
in tne an. 

"&* document member of the same patent family 



Date of mailing of the international search report 



-Authorized officer 



B. Faisal/LR 



Form PCT/ISA/210 (second sheet) (July 1992) 



page 1 of 2 



INTERNATIONAL SEARCH REPORT 



In* -national Application No 

KwT/NO 00/OG4Q3 



dContinuation) DOCUMENTS CONSIDERED TO BE RELEVANT 



Category ° 



Citation ol document, with indication, where appropriate, ot me relevant passages 



Relevant to claim No. 



H0OGENBO0M P ET AL: "Computer System 
Performance Problem Detection Using Time 
Series Models" 

PROC OF THE USENIX SUMMER 1993, [Online] 
21 - 25 June 1993, pages 1-15, 
XP002901599 
CINCINNATI, OHIO 
Retrieved from the Internet: 
<URL : www . useni x . org/publ i cati ons/ 1 i brary/p 
roceedi ngs/ci nci 93/f ul 1 papers/hoogen . txt> 
[retrieved on 2001-03-07] 
the whole document 

US 5 651 006 A (FUJINO S ET AL) 
22 July 1997 (1997-07-22) 
the whole document 

EP 0 940 754 A (HEWLETT PACKARD CO) 
8 September 1999 (1999-09-08) 
the whole document 



1-10 



1-10 



1-10 



Form PCT/lSA/210 (continuation ot second sheeO (July 19921 



page 2 of 2 



INTERNATIONAL SEARCH REPORT 

Information on patent tamtty members 



-national Application No 

PCT/NO 00/00403 



Patent document 
cited in search report 



Publication 
date 



Patent family 
member(s) 



Publication 
date 



WO 9945468 



10-09-1999 



AU 
EP 



2985999 A 
1058886 A 



20-09-1999 
13-12-2000 



US 5561769 


A 


01-10- 


■1996 


CA 


2145921 A 


11-11-1995 








EP 


0682429 A 


15-11-1995 










JP 


7319793 A 


08-12-1995 


US 5651006 


A 


22-07- 


1997 


JP 


7334445 A 


22-12-1995 


EP 0940754 


A 


08-09- 


1999 


US 


6138122 A 


24-10-2000 








AU 


8935898 A 


16-09-1999 










BR 


9805175 A 


09-11-1999 










CN 


1227931 A 


08-09-1999 










JP 


11327946 A 


30-11-1999 



£ orm PCT/ISA/21Q (Da tent tamoy annex) Uu*Y 1992) 



